AI Proctoring and GDPR: For Institutions in the UK and Europe

With the rise of artificial intelligence in education, AI proctoring has emerged as a key tool for ensuring academic integrity. For universities and educational institutions in the UK and Europe, GDPR compliance remains central to adopting any data-driven technology.

As of February 2026, the regulatory landscape has shifted significantly. With the UK's Data (Use and Access) Act 2025 (DUAA) now in full force, alongside the pending enforcement of the EU AI Act, higher education institutions face new standards for transparency, digital equity, and data ownership.

At Eye, we’ve built AI proctoring software to not only meet these standards but exceed them through institutional control and privacy-first design.

AI proctoring systems may capture:

• Video and audio records

• Identity verification images

• Device and session metadata

• Biometric or behavioural information
  
  

All of these fall under GDPR’s definition of personal data, meaning they must be processed lawfully and transparently.

Under GDPR, universities are typically the data controller,  they decide why and how personal data is used, even when relying on third‑party vendors. 

Non‑compliance can lead to enforcement actions, reputational damage, and potentially significant fines.

1. Lawfulness, Fairness & Transparency: Process data legally and explain usage to students.
   
   

2. Purpose Limitation: Collect data only for clearly defined assessment purposes.

4. Data Minimisation: Limit personal data to what is necessary.
   
   

5. Storage Limitation: Retain data only as long as required.
   
   

6. Integrity & Confidentiality: Protect data from loss or unauthorized access.
   
   

Accountability: Demonstrate GDPR compliance through policies and processes.

Navigating the “Right to Explanation”

The 2025 UK reforms emphasize Data Candour, requiring institutions to explain AI proctoring decisions clearly. Eye’s event-based logic provides transparent, evidence-based trails, helping staff respond confidently to Subject Access Requests (SARs) and reducing legal friction.

Solving the Digital Equity Mandate

Regulators now focus on digital accessibility. Remote exams requiring high-speed internet may be discriminatory under 2026 equality standards. Eye’s low-bandwidth architecture ensures all students, regardless of location or socioeconomic status, can participate fairly.

Reclaiming Institutional Control

Under the 2026 framework, universities  not vendors  are data controllers responsible for compliance. Eye’s Data Sovereignty model allows institutions to host the system locally, keeping biometric and exam data secure and eliminating risks from third-party cloud providers or international data transfers.

• Vendors collecting excessive personal data beyond necessity

• Continuous surveillance models conflicting with data minimisation

• Data transferred outside GDPR-adequate jurisdictions

• Lack of transparency about processing purposes

Even metadata like IP addresses, timestamps, and device identifiers can be classified as personal data when linked to a specific test taker (Lexdex Solutions: Personal Data in Exams)

To stay compliant, institutions should implement:

• Lawful Basis for Processing: Document the legal reason for exam data, e.g., legitimate interest or public task.
  
  

• Transparency: Inform students what data is collected, why, how long it’s stored, and who can access it.
  
  

• Security Controls: Encrypt storage, limit access, and retain data only as needed (ICO: Security Measures).
  
  

• Controller vs Processor Roles: Contracts should clearly define responsibilities (UK Gov Guidance).

Eye’s design aligns with GDPR principles, allowing institutions to adopt AI proctoring confidently:

• Institutional Control: Universities retain full ownership and authority over assessment data.
  
  

• Purpose-Bound Monitoring: Data is collected only during active exam sessions.
  
  

• Event-Driven Detection: AI captures only integrity-relevant signals, reducing unnecessary data collection.
  
  

• Human Oversight: Staff retain final review and decision-making authority.
  
  

• Secure Architecture: Data handling meets GDPR standards for confidentiality, integrity, and accountability.